Network Monitor

[Quinten Verhelst]

Hi,

 

Im looking for a way to monitor network usage per device on my entire network.
Im thinking of going through a proxy or something like that.

I know handycache lets you see traffic in real time, but it limits you to 5 users.

I'm just looking for a log of all dns requests of all devices. Something that could run on a server.

Linux , windows I dont care...

Do you have any suggestions.

Thanks in advance

[Lurick]

Do you want DNS requests or traffic usage or both?

Free or paid or either so long as it's not crazy expensive?

[Leonard]

Wireshark should work for you but if you have a router that has 3rd party firmware that will do it too if not better and easier.

[Quinten Verhelst]

16 minutes ago, Lurick said:

Do you want DNS requests or traffic usage or both?

Free or paid or either so long as it's not crazy expensive?

both if possible and free of course 

[Quinten Verhelst]

But can you see all traffic from ALL clients on the network on just one list?

[Lurick]

4 minutes ago, Quinten Verhelst said:

both if possible

For DNS and stats I would suggest OpenDNS with Umbrella:

https://www.opendns.com/home-internet-security/

OpenDNS by itself is free but for stats I believe you pay or you can get Umbrella on top of that for $20/year, just have to scroll down to the bottom and it provides OpenDNS functionality plus additional protection such as malware blocking.

 

For bandwidth usage let me see what I can dig up. Most of the tools I use need some form of netflow but I'm sure there is something out there that can provide the same level of visibility without it.

[Lurick]

For traffic monitoring and analysis, check out one of these tools and see what works best for you:

Nagios Core, Zabbix, Capsa, or Icinga 2

[Quinten Verhelst]

13 minutes ago, Lurick said:

For traffic monitoring and analysis, check out one of these tools and see what works best for you:

Nagios Core, Zabbix, Capsa, or Icinga 2

Will look into those...

Thanks

[brwainer]

5 hours ago, Lurick said:

For traffic monitoring and analysis, check out one of these tools and see what works best for you:

Nagios Core, Zabbix, Capsa, or Icinga 2

Just want to say that Icinga is a fork of Nagios and of the two Icinga is vastly superior. But I don’t think any of these serve what the OP is asking for.

[Lurick]

31 minutes ago, brwainer said:

Just want to say that Icinga is a fork of Nagios and of the two Icinga is vastly superior. But I don’t think any of these serve what the OP is asking for.

Yah, I was looking at ntopng as well but I'm not 100% sure if it would work like I think it does or not.

[Levisallanon]

Do you have an overview of your network layout? Depending on the layout you might be able to do things.

Also do you only want to monitor traffic which goes to and from the outside or also all internal traffic?

[Quinten Verhelst]

2 hours ago, Levisallanon said:

Do you have an overview of your network layout? Depending on the layout you might be able to do things.

Also do you only want to monitor traffic which goes to and from the outside or also all internal traffic?

I'm only interested in traffic that goes outside

[Levisallanon]

On 1/24/2018 at 3:41 PM, Quinten Verhelst said:

I'm only interested in traffic that goes outside

Does your edge router support SPAN (https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html) or something similar. Or do you have a box which can be put in between or after the router which has 2 sufficient network ports?

[Quinten Verhelst]

1 hour ago, Levisallanon said:

Does your edge router support SPAN (https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html) or something similar. Or do you have a box which can be put in between or after the router which has 2 sufficient network ports?

No my route, does not support that, But now you say that I can have a PC that has 2 network cards (assuming that one of them can be a gigabit USB adapter). Maybe pfSense has an option to see all traffic.

[Levisallanon]

1 hour ago, Quinten Verhelst said:

No my route, does not support that, But now you say that I can have a PC that has 2 network cards (assuming that one of them can be a gigabit USB adapter). Maybe pfSense has an option to see all traffic.

There are also reporting tool for wireshark which you can use for this I believe.
But pfsense should have something like that too probably.
Hope this helps

[Quinten Verhelst]

1 minute ago, Levisallanon said:

There are also reporting tool for wireshark which you can use for this I believe.
But pfsense should have something like that too probably.
Hope this helps

Thanks , will try those